Webservice-DIC yoyaku_41 Remote Arbitrary Command Injection Vulnerability

Bugtraq ID:	36362
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 11 2009 12:00AM
Updated:	Jan 18 2010 05:41PM
Credit:	Keigo Yamazaki of LAC Co., Ltd.
Vulnerable:	Webservice-DIC yoyaku_v41 1.10
Not Vulnerable:	Webservice-DIC yoyaku_v41 1.20

Webservice-DIC yoyaku_41 Remote Arbitrary Command Injection Vulnerability

Webservice-DIC yoyaku_41 is prone to a remote command-injection vulnerability because it fails to adequately sanitize user-supplied input data.

Remote attackers can exploit this issue to execute arbitrary shell commands with the privileges of the user running the application.

This issues affects yoyaku_41 1.10 and prior versions.

Webservice-DIC yoyaku_41 Remote Arbitrary Command Injection Vulnerability

An attacker can exploit the issue via a browser.

Webservice-DIC yoyaku_41 Remote Arbitrary Command Injection Vulnerability

Solution:
Updates are available. Please see the references for details.

Webservice-DIC yoyaku_41 Remote Arbitrary Command Injection Vulnerability

References:

• Product homepage (Webservice-DIC)
  
• Webservice-DIC yoyaku_v41 vulnerable to command injection (JVN)
  
• Webservice-DIC yoyaku_v41 vulnerable to command injection (JVN)
  
• yoyaku_v41 update (Webservice-DIC)
  
• LAC Advisory No.102 - yoyaku_v41 OS Command Injection Vulnerability (LAC)